CRITICAL 

INFRASTRUCTURE 

PROTECTION

Observations on DHS 

Efforts to Identify, 

Prioritize, Assess, and 

Inspect Chemical Facilities 

Statement of Stephen L. Caldwell,

Director, Homeland Security and Justice

Testimony Before the Subcommittee on 

Cybersecurity, Infrastructure Protection,

and Security Technologies, Committee on 

Homeland Security, House of Representatives

For Release on Delivery 

Expected at 10:00 a.m. EST

Thursday, February 27, 2014

GAO-14-365T

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-14-365T, a testimony 

before the Subcommittee on Cybersecurity, 

Infrastructure Protection, and Security 

Technologies, Committee on Homeland 

Security, House of Representatives

February 2014

CRITICAL INFRASTRUCTURE PROTECTION

Observations on DHS Efforts to Identify, Prioritize, 

Assess, and Inspect Chemical Facilities

Why GAO Did This Study

Facilities that produce, store, or use 

hazardous chemicals could be of 

interest to terrorists intent on using 

toxic chemicals to inflict mass 

casualties in the United States. As 

required by statute, DHS issued 

regulations establishing standards for 

the security of these facilities. DHS

established the CFATS program to 

assess risk at facilities covered by the 

regulations and inspect them to ensure 

compliance. In February 2014, 

legislation was introduced related to 

several aspects of the program.

This statement provides observations 

on DHS efforts related to the CFATS 

program. It is based on the results of 

previous GAO reports in July 2012 and 

April 2013, with selected updates

conducted in February 2014. In 

conducting the earlier work, GAO 

reviewed DHS reports and plans on 

the program and interviewed DHS 

officials. In addition, GAO interviewed 

DHS officials to update information. 

What GAO Recommends

In a July 2012 report, GAO 

recommended that DHS measure its 

performance implementing actions to 

improve its management of CFATS. In 

an April 2013 report, GAO 

recommended that DHS enhance its 

risk assessment approach to 

incorporate all elements of risk, 

conduct a peer review, and gather 

feedback on its outreach to facilities. 

DHS concurred with these 

recommendations and has taken

actions or has actions underway to 

address them.

GAO provided a draft of the updated 

information to DHS for review, and 

DHS confirmed its accuracy.

What GAO Found

In managing its Chemical Facility Anti-Terrorism Standards (CFATS) program, 

the Department of Homeland Security (DHS) has a number of efforts underway 

to identify facilities that are covered by the program, assess risk and prioritize 

facilities, review and approve facility security plans, and inspect facilities to 

ensure compliance with security regulations.

• Identifying facilities. DHS has begun to work with other agencies to identify 

facilities that should have reported their chemical holdings to CFATS, but 

may not have done so. DHS initially identified about 40,000 facilities by 

publishing a CFATS rule requiring that facilities with certain types of 

chemicals report the types and quantities of these chemicals. However, a 

chemical explosion in West, Texas last year demonstrated the risk posed by 

chemicals covered by CFATS. Subsequent to this incident, the President 

issued Executive Order 13650 which was intended to improve chemical 

facility safety and security in coordination with owners and operators. Under 

the executive order, a federal working group is sharing information to identify 

additional facilities that are to be regulated under CFATS, among other 

things.

• Assessing risk and prioritizing facilities. DHS has begun to enhance its 

ability to assess risks and prioritize facilities. DHS assessed the risks of 

facilities that reported their chemical holdings in order to determine which 

ones would be required to participate in the program and subsequently 

develop site security plans. GAO’s April 2013 report found weaknesses in 

multiple aspects of the risk assessment and prioritization approach and made 

recommendations to review and improve this process. In February 2014, 

DHS officials told us they had begun to take action to revise the process for 

assessing risk and prioritizing facilities.

• Reviewing security plans. DHS has also begun to take action to speed up 

its reviews of facility security plans. Per the CFATS regulation, DHS was to 

review security plans and visit the facilities to make sure their security 

measures met the risk-based performance standards. GAO’s April 2013 

report found a 7- to 9-year backlog for these reviews and visits, and DHS has 

begun to take action to expedite these activities. As a separate matter, one of 

the performance standards—personnel surety, under which facilities are to 

perform background checks and ensure appropriate credentials for personnel 

and visitors as appropriate—is being developed. As of February 2014, DHS 

has reviewed and conditionally approved facility plans pending final 

development of the personal surety performance standard.

• Inspecting to verify compliance. In February 2014, DHS reported it had

begun to perform inspections at facilities to ensure compliance with their site 

security plans. According to DHS, these inspections are to occur about 1

year after facility site security plan approval. Given the backlog in plan 

approvals, this process has started recently and GAO has not yet reviewed 

this aspect of the program. View GAO-14-365T. For more information, 

contact Stephen Caldwell at (202) 512-9610 or 

caldwells@gao.gov
Page 1 GAO-14-365T 

Chairman Meehan, Ranking Member Clarke, and Members of the 

Subcommittee:

I am pleased to be here today to discuss our work on the Department of 

Homeland Security’s (DHS) efforts in implementing and managing the 

Chemical Facility Anti-Terrorism Standards (CFATS) program. Facilities

that produce, store, or use hazardous chemicals could be of interest to 

terrorists intent on using toxic chemicals to cause harm to surrounding 

populations during terrorist attacks, and these chemicals could be stolen 

and used as chemical weapons, such as improvised explosive devices, or 

as the ingredients for making chemical weapons. The danger posed by 

these chemicals became evident last year when ammonium nitrate—one 

of the chemicals covered by the CFATS program—detonated during a fire 

at a fertilizer storage and distribution facility in West, Texas. An 

investigation by the U.S. Chemical Safety Board (CSB) showed that the 

explosion killed at least 14 people and injured more than 200 others and 

severely damaged or destroyed nearly 200 homes, 3 nearby schools, a 

nursing home, and an apartment complex.1

The DHS appropriations act for fiscal year 2007

According to CSB, the fire at 

the facility detonated about 30 tons of ammonium nitrate. This event 

serves as a tragic reminder of the extent to which chemicals covered by 

the CFATS program can pose a risk to surrounding populations.

2 required DHS to issue 

regulations to establish risk-based performance standards for securing 

facilities that possess, store, manufacture, or use chemicals that could be 

of interest to terrorists, among other things.3

 1

Rafael Moure-Eraso, Chairperson, U.S. Chemical Safety Board, testimony before the 

Senate Committee on Environment and Public Works, 113th Congress 1st Sess., June 

27, 2013. The CSB is an independent federal agency charged with investigating industrial 

chemical accidents. The CSB board members are appointed by the President and 

confirmed by the Senate. According to the CSB website, CSB does not issue fines or 

citations, but makes recommendations to plants, regulatory agencies, industry 

organizations, and labor groups.

In 2007, DHS established 

the CFATS program to assess the risk posed by chemical facilities, place 

2

Pub. L. No. 109-295, § 550, 120 Stat. 1355, 1388 (2006).

3

The CFATS regulation establishes 18 risk-based performance standards that identify the 

areas for which a facility’s security are to be examined, such as perimeter security, access 

control, and cyber security. To meet these standards, facilities are free to choose 

whatever security programs or processes they deem appropriate so long as DHS 

determines that the facilities achieve the requisite level of performance in each applicable 

standard.
Page 2 GAO-14-365T 

facilities considered to be high-risk in one of four risk-based tiers, require 

high-risk facilities to develop security plans, review these plans, and 

inspect the facilities to ensure compliance with regulatory requirements. 

DHS’s National Protection and Programs Directorate (NPPD) is 

responsible for the CFATS program. Within NPPD, the Infrastructure 

Security Compliance Division (ISCD), a division of the Office of 

Infrastructure Protection (IP), manages the program.

On February 6, 2014, congressman Meehan and other Members of the 

House of Representatives’ Committee on Homeland Security, along with 

one member of the House of Representatives’ Committee on Energy and 

Commerce, introduced H.R. 4007, the Chemical Facility Anti-Terrorism 

Standards Program Authorization and Accountability Act of 2014.4

• require DHS to consult with the heads of other federal agencies, 

states and political subdivisions and business associations to identify 

chemical facilities of interest;

This 

bill would authorize the CFATS program for 2 years and would take effect 

30 days after enactment. This bill includes provisions regarding multiple 

aspects of the CFATS program, including risk assessment, security plan 

reviews, and facility inspections. Among other things, H.R. 4007 would

• direct DHS to develop a risk assessment approach that includes all 

elements of risk, including threat data based on available intelligence, 

the vulnerability of the facility to terrorist attack, and consequence 

measurements including potential economic consequences;

• reaffirm the risk-based performance standard approach to facility 

security plans and the use of Alternative Security Programs5

• allow chemical facilities to utilize any federal screening program that 

periodically vets individuals against the terrorist screening database to 

satisfy the requirements of a personnel surety performance standard;6

 4

H.R. 4007, 113th Cong. (2014).

5 Under current regulations, an Alternative Security Program (ASP) is a third-party, facility, 

or industry organization’s security program that has been determined to meet the 

requirements of, and provides for an equivalent level of security to that established by the 

CFATS regulation. CFATS allows regulated chemical facilities to submit an ASP in lieu of 

a site security plan. 6 C.F.R. § 27.235.

6

Personnel surety is one of the CFATS performance standards under which facilities are 

to perform background checks and ensure appropriate credentials for personnel and 

visitors as appropriate. 
Page 3 GAO-14-365T 

• authorize the use of non-department or non-government entities, with 

the Secretary’s approval, for audits and inspections; and

• require us to submit a semiannual report to Congress containing our 

assessment of the implementation of the bill.

My testimony today summarizes our past work on the CFATS program 

and provides our observations on the status of DHS’s efforts in four key 

areas—identifying facilities to be covered by CFATS, assessing risk and 

prioritizing covered facilities, reviewing facility security plans, and 

inspecting facilities to verify compliance with CFATS regulations. My 

statement is based on reports and testimonies we issued from July 2012 

through August 2013 on various aspects of the CFATS program in 

addition to work we conducted in February 2014 to update the status of 

DHS actions related to these four areas.7

We conducted the work on which this statement is based in accordance 

with generally accepted government auditing standards. Those standards 

require that we plan and perform the audit to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and conclusions 

To conduct our prior work, we 

reviewed applicable laws and regulations, as well as NPPD, IP, and ISCD 

policies and procedures for administering the CFATS program and 

conducting its mission. We interviewed senior ISCD officials along with 

NPPD and IP officials to obtain their views on the program and how ISCD 

assesses risk. We also reviewed ISCD documents and data on tiered 

facilities and the approach used to determine a facility’s risk and 

assessed ISCD’s process for reviewing security plans. Further details on 

the scope and methodology for the previously issued reports are available 

within each of the published products. To update our work, we met with 

senior ISCD officials and discussed status updates on the four areas 

(identifying facilities, assessing risk and prioritizating facilities, reviewing 

security plans, and inspecting facilities). Where possible, we also 

reviewed available documentation pertinent to each of the key areas. We 

provided a copy of new information in this statement to DHS for review. 

DHS confirmed the accuracy of this information.

 7

GAO, Critical Infrastructure Protection: DHS Needs to Improve Its Risk Assessments and 

Outreach for Chemical Facilities, GAO-13-801T (Washington, D.C.: Aug. 1, 2013); Critical 

Infrastructure Protection: DHS Efforts to Assess Chemical Security Risk and Gather 

Feedback on Facility Outreach Can Be Strengthened, GAO-13-353 (Washington, D.C.: 

Apr. 5, 2013); Critical Infrastructure Protection: DHS Is Taking Action to Better Manage Its 

Chemical Security Program, but It Is Too Early to Assess Results, GAO-12-515T

(Washington, D.C.: July 26, 2012). 
Page 4 GAO-14-365T 

based on our audit objectives. We believe the evidence obtained provides 

a reasonable basis for our findings and conclusions based on our audit 

objectives.

DHS has begun to take action to work with other agencies to identify 

facilities that are required to report their chemical holdings to DHS but 

may not have done so.

The first step of the CFATS process is focused on identifying facilities that 

might be required to participate in the program. The CFATS rule was 

published in April 2007,8 and appendix A to the rule, published in 

November 2007, listed 322 chemicals of interest and the screening 

threshold quantities for each.9

In August 2013, we testified about the ammonium nitrate explosion at the 

chemical facility in West, Texas, in the context of our past CFATS work. 

Among other things, the hearing focused on whether the West, Texas, 

facility should have reported its holdings to ISCD given the amount of 

ammonium nitrate at the facility. During this hearing, the Director of the 

CFATS program remarked that throughout the existence of CFATS, DHS 

As a result of the CFATS rule, about 

40,000 chemical facilities reported their chemical holdings and their 

quantities to DHS’s ISCD.

 8

72 Fed. Reg. 17,688 (Apr. 9, 2007) (codified at 6 C.F.R. pt. 27). 

9

72 Fed. Reg. 65,396 (Nov. 20, 2007). According to DHS, CFATS covers facilities that 

manufacture chemicals as well as facilities that store or use certain chemicals as part of 

their daily operations. This can include food-manufacturing facilities that use chemicals of 

interest in the manufacturing process, universities that use chemicals to do experiments, 

or warehouses that store ammonium nitrate, among others.

Observations on 

DHS Efforts to 

Identify Facilities, 

Assess Risk, Review 

Security Plans, and 

Verify Compliance

Identifying Facilities 

Covered by CFATS
Page 5 GAO-14-365T 

had undertaken and continued to support outreach and industry 

engagement to ensure that facilities comply with their reporting 

requirements. However, the Director stated that the CFATS regulated 

community is large and always changing and DHS relies on facilities to 

meet their reporting obligations under CFATS. At the same hearing, a 

representative of the American Chemistry Council testified that the West, 

Texas, facility could be considered an “outlier” chemical facility, that is, a 

facility that stores or distributes chemical-related products, but is not part 

of the established chemical industry. Preliminary findings of the CSB 

investigation of the West, Texas, incident showed that although certain 

federal agencies that regulate chemical facilities may have interacted with 

the facility, the ammonium nitrate at the West, Texas, facility was not 

covered by these programs. For example, according to the findings, the 

Environmental Protection Agency’s (EPA) Risk Management Program, 

which deals with the accidental release of hazardous substances, covers 

the accidental release of ammonia, but not ammonium nitrate.10

On August 1, 2013, the same day as the hearing, the President issued 

Executive Order 13650–Improving Chemical Facility Safety and Security, 

which was intended to improve chemical facility safety and security in 

coordination with owners and operators.

As a 

result, the facility’s consequence analysis considered only the possibility 

of an ammonia leak and not an explosion of ammonium nitrate.

11

 10See 40 C.F.R. § 68.130.

The executive order 

established a Chemical Facility Safety and Security Working Group, 

composed of representatives from DHS; EPA; and the Departments of 

Justice, Agriculture, Labor, and Transportation, and directed the working 

group to identify ways to improve coordination with state and local 

partners; enhance federal agency coordination and information sharing; 

modernize policies, regulations and standards; and work with 

stakeholders to identify best practices. In February 2014, DHS officials 

told us that the working group has taken actions in the areas described in 

the executive order. For example, according to DHS officials, the working 

group has held listening sessions and webinars to increase stakeholder 

input, explored ways to share CFATS data with state and local partners to 

increase coordination, and launched a pilot program in New York and 

New Jersey aimed at increasing federal coordination and information 

sharing. DHS officials also said that the working group is exploring ways 

11Exec. Order No. 13,650, 78 Fed. Reg. 48,029 (Aug. 1, 2013).
Page 6 GAO-14-365T 

to better share information so that federal and state agencies can identify 

non-compliant chemical facilities and identify options to improve chemical 

facility risk management. This would include considering options to 

improve the safe and secure storage, handling, and sale of ammonium 

nitrate.

DHS has also begun to take actions to enhance its ability to assess risk 

and prioritize facilities covered by the program.

For the second step of the CFATS process, facilities that possess any of 

the 322 chemicals of interest at levels at or above the screening threshold 

quantity must first submit data to ISCD via an online tool called a TopScreen.12 ISCD uses the data submitted in facilities’ Top Screens to make 

an assessment as to whether facilities are covered under the program. If 

DHS determines that they are covered by CFATS, facilities are to then 

submit data via another online tool, called a security vulnerability 

assessment, so that ISCD can further assess their risk and prioritize the 

covered facilities.13 ISCD uses a risk assessment approach to develop 

risk scores to assign chemical facilities to one of four final tiers. Facilities 

placed in one of these tiers (tier 1, 2, 3, or 4) are considered to be high 

risk, with tier 1 facilities considered to be the highest risk.14

Our prior work showed that the CFATS program was using an incomplete 

risk assessment approach to assign chemical facilities to a final tier. 

Specifically, in April 2013, we reported that the approach ISCD used to 

assess risk and make decisions to place facilities in final tiers did not 

The risk score 

is intended to be derived from estimates of consequence (the adverse 

effects of a successful attack), threat (the likelihood of an attack), and 

vulnerability (the likelihood of a successful attack, given an attempt). 

ISCD’s risk assessment approach is composed of three models, each 

based on a particular security issue: (1) release, (2) theft or diversion, and 

(3) sabotage, depending on the type of risk associated with the 322 

chemicals. Once ISCD estimates a risk score based on these models, it 

assigns the facility to a final tier.

 126 C.F.R. § 27.200(b)(2).

136 C.F.R. §§ 27.215, .220.

146 C.F.R. § 27.220

Assessing Risk and 

Prioritizing Facilities
Page 7 GAO-14-365T 

consider all of the elements of consequence, threat, and vulnerability 

associated with a terrorist attack involving certain chemicals. For 

example, the risk assessment approach was based primarily on 

consequences arising from human casualties, but did not consider 

economic criticality consequences, as called for by the 2009 National 

Infrastructure Protection Plan (NIPP)15 and the CFATS regulation.16

ISCD agreed with our recommendations, and in February 2014, ISCD 

officials told us that they were taking steps to address them and 

recommendations of a recently released Homeland Security Studies and 

Analysis Institute (HSSAI) report that examined the CFATS risk 

In 

April 2013, we reported that ISCD officials told us that, at the inception of 

the CFATS program, they did not have the capability to collect or process 

all of the economic data needed to calculate the associated risks and they 

were not positioned to gather all of the data needed. They said that they 

collected basic economic data as part of the initial screening process; 

however, they would need to modify the current tool to collect more 

sufficient data. We also found that the risk assessment approach did not 

consider threat for approximately 90 percent of tiered facilities. Moreover, 

for the facilities that were tiered using threat considerations, ISCD was 

using 5-year-old data. We also found that ISCD’s risk assessment 

approach was not consistent with the NIPP because it did not consider 

vulnerability when developing risk scores. When assessing facility risk, 

ISCD’s risk assessment approach treated every facility as equally 

vulnerable to a terrorist attack regardless of location and on-site security. 

As a result, in April 2013 we recommended that ISCD enhance its risk 

assessment approach to incorporate all elements of risk and conduct a 

peer review after doing so.

 15DHS, National Infrastructure Protection Plan (Washington, D.C.: June 2006). The NIPP 

sets forth the risk management framework for the protection and resilience of the nation’s 

critical infrastructure. DHS updated the NIPP in January 2009 to include resiliency. See 

DHS, National Infrastructure Protection Plan, Partnering to Enhance Protection and 

Resiliency (Washington, D.C.: January 2009). Broadly defined, risk management is a 

process that helps policymakers assess risk, strategically allocate finite resources, and 

take actions under conditions of uncertainty. DHS further updated the NIPP, which is now 

called the National Plan, in December 2013. See DHS, NIPP 2013, Partnering for Critical 

Infrastructure Security and Resilience (Washington, D.C.: December 2013).

16 The CFATS regulation states that chemical facilities covered by the rule are those that 

present a high risk of significant adverse consequences for human life or health, or critical 

economic assets, among other things, if subjected to terrorist attack, compromise, 

infiltration, or exploitation. 6 C.F.R. §§ 27.105, .205.
Page 8 GAO-14-365T 

assessment model.17

In February 2014, senior ISCD officials told us that they have developed 

an implementation plan that outlines how they plan to modify the risk 

assessment approach to better include all elements of risk while 

incorporating our findings and recommendations and those of HSSAI.

Moreover, these officials stated that they have completed significant work 

with Sandia National Laboratory with the goal of including economic 

consequences into their risk tiering approach. They said that the final 

results of this effort to include economic consequences will be available in 

the summer of 2014. With regard to threat and vulnerability, ISCD officials 

said that they have been working with multiple DHS components and 

agencies, including the Transportation Security Administration and the 

Coast Guard, to see how they consider threat and vulnerability in their 

risk assessment models. ISCD officials said that they anticipate that the 

changes to the risk tiering approach should be completed within the next 

12 to 18 months. We plan to verify this information as part of our 

recommendation follow-up process.

As with the findings in our report, HSSAI found, 

among other things, that the CFATS risk assessment model 

inconsistently considers risks across different scenarios and that the 

model does not adequately treat facility vulnerability. Overall, HSSAI 

recommended that ISCD revise the current risk-tiering model and create 

a standing advisory committee—with membership drawn from 

government, expert communities, and stakeholder groups—to advise 

DHS on significant changes to the methodology.

DHS has begun to take action to lessen the time it takes to review site 

security plans which could help DHS reduce the backlog of plans awaiting 

review.

For the third step of the CFATS process, ISCD is to review facility security 

plans and their procedures for securing these facilities. Under the CFATS 

rule, once a facility is assigned a final tier, it is to submit a site security 

plan or participate in an alternative security program in lieu of a site 

 17 Homeland Security Studies and Analysis Institute, CFATS Tiering Methodology Peer 

Review (For Official Use Only) (Falls Church, Virginia: October 2013). The Homeland 

Security Studies and Analysis Institute, operated by Analytic Services Inc. on behalf of 

DHS, is a federally funded research and development center providing independent 

analyses of homeland security issues.

Reviewing of Facilities’

Security Plans
Page 9 GAO-14-365T 

security plan. The security plan is to describe security measures to be 

taken and how such measures are to address applicable risk-based 

performance standards.18

In April 2013, we reported that it could take another 7 to 9 years before 

ISCD would be able to complete reviews of the approximately 3,120 plans 

in its queue at that time. As a result, we estimated that the CFATS 

regulatory regime, including compliance inspections (discussed in the 

next section), would likely not be implemented for 8 to 10 years. We also 

noted in April 2013 that ISCD had revised its process for reviewing 

facilities’ site security plans. ISCD officials stated that they viewed ISCD’s 

revised process to be an improvement because, among other things, 

teams of experts reviewed parts of the plans simultaneously rather than 

sequentially, as had occurred in the past. In April 2013, ISCD officials 

said that they were exploring ways to expedite the process, such as 

streamlining inspection requirements.

After ISCD receives the site security plan, the 

plan is reviewed using teams of ISCD employees (i.e., physical, cyber, 

chemical, and policy specialists), contractors, and ISCD inspectors. If 

ISCD finds that the requirements are satisfied, ISCD issues a letter of 

authorization to the facility. After ISCD issues a letter of authorization to 

the facility, ISCD is to then inspect the facility to determine if the security 

measures implemented at the site comply with the facility’s authorized 

plan. If ISCD determines that the site security plan is in compliance with 

the CFATS regulation, ISCD approves the site security plan, and issues a 

letter of approval to the facility, and the facility is to implement the 

approved site security plan.

In February 2014, ISCD officials told us that they are taking a number of 

actions intended to lessen the time it takes to complete reviews of 

remaining plans including the following:

• providing updated internal guidance to inspectors and ISCD 

reviewers;

• updating the internal case management system;

• providing updated external guidance to facilities to help them better 

prepare their site security plans;

 186 C.F.R. § 27.225.
Page 10 GAO-14-365T 

• conducting inspections using one or two inspectors at a time over the 

course of 1 day, rather than multiple inspectors over the course of 

several days;

• conducting pre-inspection calls to the facility to help resolve technical 

issues beforehand;

• creating and leveraging the use of corporate inspection documents 

(i.e., documents for companies that have over seven regulated 

facilities in the CFATS program);19

• supporting the use of alternative security programs to help clear the 

backlog of security plans because, according to DHS officials, 

alternative security plans are easier for some facilities to prepare and 

use; and

• taking steps to streamline and revise some of the on-line data 

collection tools such as the site security plan to make the process 

faster.

It is too soon to tell whether DHS’s actions will significantly reduce the 

amount of time needed to resolve the backlog of site security plans 

because these actions have not yet been fully implemented.

In April 2013, we also reported that DHS had not finalized the personnel 

surety aspect of the CFATS program. The CFATS rule includes a riskbased performance standard for personnel surety, which is intended to 

provide assurance that facility employees and other individuals with 

access to the facility are properly vetted and cleared for access to the 

facility. In implementing this provision, we reported that DHS intended to 

(1) require facilities to perform background checks on and ensure 

appropriate credentials for facility personnel and, as appropriate, visitors 

with unescorted access to restricted areas or critical assets, and (2) 

check for terrorist ties by comparing certain employee information with its 

terrorist screening database. However, as of February 2014, DHS had not 

finalized its information collection request that defines how the personal 

surety aspect of the performance standards will be implemented. Thus, 

DHS is currently approving facility security plans conditionally whereby 

plans are not to be finally approved until the personnel surety aspect of 

the program is finalized. According to ISCD officials, once the personal 

 19According to ISCD officials, these documents would be designed to provide examples of 

standard operating procedures regarding employee vetting, chemical handling, or security 

practices that are standard across corporations and that could be placed in a facility’s file 

and expedite the inspection process.
Page 11 GAO-14-365T 

surety performance standard is finalized, they plan to reexamine each 

conditionally approved plan. They would then make final approval as long 

as ISCD had assurance that the facility was in compliance with the 

personnel surety performance standard. As an interim step, in February 

2014, DHS published a notice about its Information Collection Request 

(ICR) for personnel surety to gather information and comments prior to 

submitting the ICR to the Office of Management and Budget (OMB) for 

review and clearance.20

During a March 2013 hearing on the CFATS program, industry officials 

discussed using DHS’s Transportation Worker Identification Credential 

(TWIC) as one approach for implementing the personal surety program. 

The TWIC, which is also discussed in DHS’s ICR, is a biometric 

credential

According to ISCD officials, it is unclear when the 

personnel surety aspect of the CFATS program will be finalized.

21 issued by DHS for maritime workers who require unescorted 

access to secure areas of facilities and vessels regulated under the 

Maritime Transportation Security Act of 2002 (MTSA).22

 2079 Fed. Reg. 6418 (Feb. 3, 2014). DHS previously published a notice about the 

personnel surety ICR on March 22, 2013. 78 Fed. Reg. 17,680 (March 22, 2013).

In discussing 

TWIC in the context of CFATS during the August 2013 hearing, officials 

representing some segments of the chemical industry stated that they 

believe that using TWIC would lessen the reporting burden and stop 

facilities from having to submit additional personnel information to DHS 

while maintaining the integrity of the program. In May 2011, and May 

2013, we reported that the TWIC program has some shortfalls—including 

challenges in development, testing, and implementation—that may limit 

21A biometric access control system consists of technology that determines an individual’s 

identity by detecting and matching unique physical or behavioral characteristics, such as 

fingerprint or voice patterns, as a means of verifying personal identity. 

22Pub. L. No. 107-295,116 Stat. 2064. The TWIC program is intended to provide a 

tamper-resistant biometric credential to maritime workers who require unescorted access 

to secure areas of facilities and vessels regulated under the MTSA. TWIC is to enhance 

the ability of MTSA-regulated facility and vessel owners and operators to control access to 

their facilities and verify workers’ identities. Under current statute and regulation, maritime 

workers requiring unescorted access to secure areas of MTSA-regulated facilities or 

vessels are required to obtain a TWIC, and facility and vessel operators are required by 

regulation to visually inspect each worker’s TWIC before granting unescorted access. 46 

U.S.C. § 70105(a); 33 C.F.R. §§ 101.514, 104.265(c), 105.255(c). Prior to being granted a 

TWIC, maritime workers are required to undergo a background check, known as a 

security threat assessment. See 49 C.F.R § 1572.21.
Page 12 GAO-14-365T 

its usefulness with regard to the CFATS program.23 We recommended 

that DHS take steps to resolve these issues, including completing a 

security assessment that includes addressing internal controls 

weaknesses, among other things. The explanatory statement 

accompanying the Consolidated Appropriations Act, 2014, directed DHS 

to complete the recommended security assessment.24 However, as of 

February 2014, DHS had not yet done the assessment, and although 

DHS had taken some steps to conduct an internal control review, it had 

not corrected all the control deficiencies identified in our report.

DHS reports that it has begun to perform compliance inspections at 

regulated facilities. The fourth step in the CFATS process is compliance 

inspections by which ISCD determines if facilities are employing the 

measures described in their site security plans. During the August 1, 

2013, hearing on the West, Texas, explosion, the Director of the CFATS 

program stated that ISCD planned to begin conducting compliance 

inspections in September 2013 for facilities with approved site security 

plans. The Director further noted that the inspections would generally be 

conducted approximately 1 year after plan approval. According to ISCD, 

as of February 24, 2014, ISCD had conducted 12 compliance inspections. 

ISCD officials stated that they have considered using third-party nongovernmental inspectors to conduct inspections but thus far do not have 

any plans to do so.

In closing, we anticipate providing oversight over the issues outlined 

above and look forward to helping this and other committees of Congress 

continue to oversee the CFATS program and DHS’s progress in 

implementing this program. Currently, the explanatory statement 

accompanying the Consolidated and Further Continuing Appropriations 

Act, 2013, requires GAO to continue its ongoing effort to examine the 

extent to which DHS has made progress and encountered challenges in 

 23GAO, Transportation Worker Identification Credential: Card Reader Pilot Results Are 

Unreliable; Security Benefits Need to Be Reassessed, GAO-13-198 (Washington, D.C.: 

May 8, 2013); Transportation Worker Identification Credential: Internal Control 

Weaknesses Need to Be Corrected to Help Achieve Security Objectives, GAO-11-657

(Washington, D.C.: May 10, 2011).

24Explanatory statement accompanying the Consolidated Appropriations Act, 2014, Pub. 

L. No. 113-76, 128 Stat. 5 (2014).

Inspecting to Verify 

Compliance with

Facility Plans
Page 13 GAO-14-365T 

developing CFATS. Additionally, once the CFATS program begins 

performing and completing a sufficient number of compliance inspections, 

we are mandated review those inspections along with various aspects of 

them.25

Chairman Meehan, Ranking Member Clarke, and members of the 

subcommittee, this completes my prepared statement. I would be happy 

to respond to any questions you may have at this time.

Moreover, Ranking Member Thompson of the Committee on 

Homeland Security has requested that we examine among other things, 

DHS efforts to assess information on facilities that submit data, but that 

DHS ultimately decides are not to be covered by the program.

For information about this statement please contact Stephen L. Caldwell, 

at (202) 512-9610 or CaldwellS@gao.gov. Contact points for our Offices 

of Congressional Relations and Public Affairs may be found on the last 

page of this statement. Other individuals making key contributions to this 

and our prior work included John F. Mortin, Assistant Director; Jose 

Cardenas, Analyst-in-Charge; Chuck Bausell; Michele Fejfar; Jeff Jensen; 

Tracey King; Marvin McGill; Jessica Orr; Hugh Paquette, and Ellen Wolfe.

 25 Explanatory statement accompanying the Consolidated and Further Continuing 

Appropriations Act, 2013, Pub. L. No. 113-6, 127 Stat. 198 (2013).

GAO Contact and 

Staff 

Acknowledgments

(441211)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.